Slashdot Mirror
Google Starts Upgrading Its SSL Certificates To 2048-bit Keys
An anonymous reader writes "Google today announced it has already started upgrading all of its SSL certificates to 2048-bit keys. The goal is to beef up the encryption on the connections made to its services. Google says the upgrade, which includes the root certificate that the company uses to sign all of its SSL certificates, will be completed 'in the next few months.' Previously, however, Google was more specific and said it was aiming to finish the process by the end of 2013."
If the NSA has the master key...
Is Google doing this because they have a D-Wave quantum annealing computer and figured out how to bust the smaller size SSL certs with it?
I wonder how this'll affect older PCs? Aren't SSL communications with larger keys more processor-intensive than when using a smaller key?
Nothing interesting to say...MUST...NOT...REPLY...ohtheheckwithit.
Try to buy an SSL certificate with 1024 bit keys. I dare you. Double dare you. Yeah, you won't be able to.
What will be news is the myriad of devices that have crappy firmware which relies on the old keys for all the wrong reasons.
The largest risk isn't during transmission, it is at the user's end... and Google's end. 2 million bit encryption wouldn't be enough if you had a keylogger, or if google got served a National Security Letter that it decided to honor.
I think the people who wield the root certs were hoping that ECC would come around before they had to switch to 2048, but it didn't. The crushing effect of certicom's obvious patents and the lateness of the NSAs RFC6090 meant that RSA won again.
I don't see anything improving on the ECC front. All the structural problems remain. We'll be messing with 4096 RSA before long and your smart cards will all have to be replaced.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
How the fuck is "by the end of 2013" more specific than "in the next few months"? First is a 5 month range, the second "generally" refers to a 2-4 month range. At worst there timeline response hasn't changed.
the bad guys will already have a decrypted copy off all our traffic handed to them anyway it makes me wonder what the point of SSL is at all anyway, who's keys don't they have now. and given how information has been pouring out of these evil entities like a sieve recently i have to assume that the ssl master keys were also leaked or published just in a more quiet way
This won't do any good when the NSA has a copy of that root certificate.
NSA Officials inside the Googleplex: Stand aside!
The initial connection setup will be more processor intensive (4x?) but the actual communications isn't done with public/private key encryption. The public/private keys are only used to verify the identity of the server and to exchange a symmetric (AES128 often) key. After the setup, the rest of the transfer will be no more complex and so shouldn't load your PC any more than before.
I've been using 4096 bit keys for over two years. Now if only /. would get into the act (I don't want freaks and weirdos at where ever I use the 'net to know a. what stories I read. b. whether I'm logged in or not. c. if I'm logged in, what my user name and password are).
Also, the moderators are all insufficiently like the "ideal" for their gender (whatever gender that is). E.g. the male identifying mods all have small penis'.
HELP MY ACCOUNT HAS BEEN HACKED BY AN ILLIBERAL ART STUDENT SET TO DESTROY THE INTERWEBZ!
Not really. There are good reasons to encrypt, you just have to understand them.
The main thing you need to realize is that encrypting something only delays the disclosure of the data. It may take a LONG time to try all the available keys, but eventually a brute force attack will be successful. Of course, if it's going to average 100 years of effort, it may not be worth it to the attacker, or it may not matter what you bank account balance was by then.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
stuff that matters
I know 128 bit encryption is very robust...2048 too much...after all these are eyewash..if asked they will provide data to Nsa anyway....
Dump all known ciphers and add numerous zeros to that key.
It does the lower bounds of a limit problem, so you can (sort of) figure out where you're looking for the values for the key, and then along with regular cpus/gpus only bruteforce it above that point/within that range.
Taking a few factors off a crypto key's seed values can certainly make cracking the key/certificate easier to do.
Once you cross a pretty low threshold it just isn't worth the time of the crackers anymore. They'll take another, easier attack vector. This is like the beefing up the Maginot Line.
The Yanks are so used to accessing Google on their bloated 2K TS-1000s, that they seem to have forgetten that those of us with the original British 1K ZX81 won't be able to access their website securely any more.
I bet those tossers are so spoiled they have blackjack and hookers, and 16K rampacks on their servers. Hope someone wobbles them (*) and they lose all their data. Gits.
(*) The rampacks, I mean. I've no idea what wobbling a hooker would do to your data.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
The terrorists are fucking assholes? But... but... I thought buttsecks was frowned upon in those parts of the world.
how is "by the end of 2013" more specific then "in the next few months". Last time I checked, 2 or 3 months is more specific then 1-5 months
until you disclose how much data *exactly* of how many users on average you're handing over to LEOs per request, I'ma not gonna trust you ever again.
As if enforcing the law is even their primary motive.
English grammar? Do you know it?
Outgoing Traffic:
Me --> SSL --> Google --> (plaintext) --> NSA Data Center --> CIA Threat Analysis --> FBI Warrantless Investigations --> Hacker Criminal Complex
Incoming Traffic:
Me -- SSL -- Google
The Yanks are so used to accessing Google on their bloated 2K TS-1000s, that they seem to have forgetten that those of us with the original British 1K ZX81 won't be able to access their website securely any more.
I bet those tossers are so spoiled they have blackjack and hookers, and 16K rampacks on their servers. Hope someone wobbles them (*) and they lose all their data. Gits.
(*) The rampacks, I mean. I've no idea what wobbling a hooker would do to your data.
if you glue the lot to a piece of mdf that sorts it out. Rampack that is. Hookers wobbling do funky things to your data, take £50 and go do some research!.
This are America so no.
So, does the NSA get the master keys to this setup?
A few months is not less specific than the end of the year. There are 5 months left in 2013, a few normally means around 3, they're actually saying that they're ahead of schedule.
Google should have done this years ago! They have all the resources to have their own structure without having their security outsourced to certification authority company like Symantec. They can even have it for free.
GMO Internet | GlobalSign Asia Pacific